Method for generating abnormal data

ABSTRACT

In an exemplary embodiment of the present disclosure, disclosed is a computer program stored in a computer readable storage medium executable by one or more processors, in which when the computer program is executed by one or more processors of a computing device, the computer program performs operations below for processing data, the operations may include: selecting a plurality of different data from a data set including data formed of one or more feature groups, transforming a part of each data among the plurality of selected data, assigning a label to each of the plurality of transformed data, and computing the transformed data by using the model.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to and the benefit of Korean PatentApplication No. 10-2020-0022452, filed in the Korean IntellectualProperty Office on Feb. 24, 2020, and claims priority to and the benefitof Korean Patent Application No. 10-2019-0134214, filed in the KoreanIntellectual Property Office on Oct. 28, 2019, the entire contents ofwhich are incorporated herein by reference.

BACKGROUND Technical Field

The present disclosure relates to an artificial intelligence technologyfield, and more particularly, to a method of processing data byutilizing artificial intelligence.

Description of the Related Art

As sensor data that can be temporarily used or permanently used by beingstored in a database is accumulated, research on the automatedprocessing of monitoring data of numerous industrial equipment is beingconducted. In order to implement the method of determining a state ofthe data, research on the artificial intelligence technology using anartificial neural network is being conducted.

A deep learning model utilizing an artificial neural network provides amethod of effectively learning complex non-linear or dynamic panels, butthere exists a technical problem for update of a model when data to beprocessed is changed.

Korean Patent Application Laid-Open No. 10-2018-0055708 discloses amethod of processing an image by utilizing artificial intelligence.

BRIEF SUMMARY

The present disclosure is conceived in response to the background art,and has been made in an effort to provide a method of processing data byutilizing artificial intelligence.

According to an exemplary embodiment of the present disclosure forsolving the object, a computer program stored in a computer readablestorage medium is disclosed. When the computer program is executed byone or more processors of a computing device, the computer programperforms operations to provide methods for processing data, and theoperations include: selecting a plurality of different data in a dataset including data formed of one or more feature groups; transforming apart of each data among the selected different data; assigning a labelto each transformed data; and calculating the transformed data using amodel.

In an alternative exemplary embodiment, the plurality of different datamay be formed of data included in the same cluster or differentclusters.

In the alternative exemplary embodiment, the operations may furtherinclude generating a plurality of data subsets through clustering dataof the data set.

In the alternative exemplary embodiment, the generating a plurality ofdata subsets through clustering data of the data set may be processedfrom a classification model trained by using a cost function based ontriplet loss.

In the alternative exemplary embodiment, each data subset in theplurality of data subsets may include different data having a normalpattern.

In the alternative exemplary embodiment, the transforming of the part ofeach data from the selected different data may include an operation ofchanging a value for one feature group among one or more feature groupsin each data.

In the alternative exemplary embodiment, the transforming of the part ofeach data from the selected different data may include an operation ofexchanging a value for one data and a value for another data among theplurality of data.

In the alternative exemplary embodiment, the exchanging a value for onedata and a value for another data among the plurality of data mayinclude an operation of exchanging values for one or more feature groupsin one data and values for one or more feature groups in another dataamong the plurality of data.

In the alternative exemplary embodiment, the exchanging of the value forone data and the value for another data among the plurality of data mayinclude an operation of exchanging values for data belonging to the samefeature group in each data.

In the alternative exemplary embodiment, the data included in the dataset may be normal data.

In the alternative exemplary embodiment, the assigning of the label toeach transformed data may include an operation of assigning an abnormallabel to each transformed data.

In the alternative exemplary embodiment, the calculating of thetransformed data using the model may include an operation of testingperformance of the model through calculating the transformed data usingthe model.

In the alternative exemplary embodiment, the testing of the performanceof the model through calculating the transformed data using the modelmay include an operation of testing performance of the model based onwhether the model determines the transformed data to be abnormal.

In the alternative exemplary embodiment, each feature group may beformed of items associated among a plurality of items included in thedata.

According to another exemplary embodiment of the present disclosure, amethod for processing data performed in a computing device including oneor more processors is disclosed. The method may include: selecting aplurality of different data in a data set including data formed of oneor more feature groups; transforming a part of each data among theselected different data; assigning a label to each transformed data; andcalculating the transformed data using a model.

According to still another exemplary embodiment of the presentdisclosure, a computing device is disclosed. The computing device mayinclude: one or more processors; and a memory storing commandsexecutable in processor, in which the processor is configured to: selecta plurality of different data in a data set including data formed of oneor more feature groups; transform a part of each data among the selecteddifferent data; assign a label to each transformed data; and calculatethe transformed data using a model.

According to yet another exemplary embodiment of the present disclosure,a computer readable recording medium storing a data structure storingdata related to a training process of a neural network model isdisclosed. The data is revised by a computer program, and the computerprogram performs operations to provide methods for processing data, andthe operations include: selecting a plurality of different data in adata set including data formed of one or more feature groups;transforming a part of each data among the selected different data; andassigning a label to each transformed data.

The present disclosure may provide a method of processing data byutilizing artificial intelligence.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

Various aspects are described with reference to the drawings, andherein, like reference numerals are generally used to designate likeconstituent elements. In the exemplary embodiment below, for the purposeof description, a plurality of specific and detailed matters issuggested in order to provide general understanding of one or moreaspects. However, it is apparent that the aspect(s) may be carried outwithout the specific and detailed matters.

FIG. 1 is a block diagram illustrating a computing device for performinga data processing method according to an exemplary embodiment of thepresent disclosure.

FIG. 2 is a schematic diagram illustrating a network function accordingto the exemplary embodiment of the present disclosure.

FIG. 3 is a diagram illustrating an example of a plurality of dataconfiguring a data set according to the exemplary embodiment of thepresent disclosure.

FIG. 4 is a schematic diagram illustrating a method of training aclassification model according to the exemplary embodiment of thepresent disclosure.

FIG. 5 is a schematic diagram illustrating a solution space of aclassification model according to the exemplary embodiment of thepresent disclosure.

FIG. 6 is a flowchart for performing data processing according to anexemplary embodiment of the present disclosure.

FIG. 7 is logic for implementing a method of performing data processingaccording to an exemplary embodiment of the present disclosure.

FIG. 8 is a simple and general schematic diagram illustrating an exampleof a computing environment in which exemplary embodiments of the presentdisclosure are implementable.

DETAILED DESCRIPTION

Various exemplary embodiments are described with reference to thedrawings. In the present specification, various descriptions arepresented for understanding the present disclosure. However, it isobvious that the exemplary embodiments may be carried out even without aparticular description.

Terms, “component,” “module,” “system,” and the like used in the presentspecification indicate a computer-related entity, hardware, firmware,software, a combination of software and hardware, or execution ofsoftware. For example, a component may be a procedure executed in aprocessor, a processor, an object, an execution thread, a program,and/or a computer, but is not limited thereto. For example, both anapplication executed in a computing device and a computing device may becomponents. One or more components may reside within a processor and/oran execution thread. One component may be localized within one computer.One component may be distributed between two or more computers. Further,the components may be executed by various computer readable media havingvarious data structures stored therein. For example, components maycommunicate through local and/or remote processing according to a signal(for example, data transmitted to another system through a network, suchas Internet, through data and/or a signal from one component interactingwith another component in a local system and a distributed system)having one or more data packets.

A term “or” intends to mean comprehensive “or,” not exclusive “or.” Thatis, unless otherwise specified or when it is unclear in context, “X usesA or B” intends to mean one of the natural comprehensive substitutions.That is, when X uses A, X uses B, or X uses both A and B, “X uses A orB” may be applied to any one among the cases. Further, a term “and/or”used in the present specification shall be understood to designate andinclude all of the possible combinations of one or more items among thelisted relevant items.

A term “include” and/or “including” shall be understood as meaning thata corresponding characteristic and/or a constituent element exists.Further, a term “include” and/or “including” means that a correspondingcharacteristic and/or a constituent element exists, but it shall beunderstood that the existence or an addition of one or more othercharacteristics, constituent elements, and/or a group thereof is notexcluded. Further, unless otherwise specified or when it is unclear thata single form is indicated in context, the singular shall be construedto generally mean “one or more” in the present specification and theclaims.

Those skilled in the art shall recognize that the various illustrativelogical blocks, configurations, modules, circuits, means, logic, andalgorithm operations described in relation to the exemplary embodimentsadditionally disclosed herein may be implemented by electronic hardware,computer software, or in a combination of electronic hardware andcomputer software. In order to clearly exemplify interchangeability ofhardware and software, the various illustrative components, blocks,configurations, means, logic, modules, circuits, and operations havebeen generally described above in the functional aspects thereof.Whether the functionality is implemented as hardware or software dependson a specific application or design restraints given to the generalsystem. Those skilled in the art may implement the functionalitydescribed by various methods for each of the specific applications.However, it shall not be construed that the determinations of theimplementation deviate from the range of the contents of the presentdisclosure.

The description about the presented exemplary embodiments is provided soas for those skilled in the art to use or carry out the presentdisclosure. Various modifications of the exemplary embodiments will beapparent to those skilled in the art. General principles defined hereinmay be applied to other exemplary embodiments without departing from thescope of the present disclosure. Therefore, the present disclosure isnot limited to the exemplary embodiments presented herein. The presentdisclosure shall be interpreted within the broadest meaning rangeconsistent to the principles and new characteristics presented herein.

In the present disclosure, a network function, an artificial neuralnetwork, and a neural network may be interchangeably used.

All of the contents included in Korean Patent Application Nos.10-2018-0080482, 10-2019-0050477, and 10-2019-0067175 filed on Jul. 11,2018, Apr. 30, 2019, and Jun. 7, 2019 are incorporated in the presentspecification as reference.

FIG. 1 is a block diagram illustrating a computing device for performinga data processing method according to an exemplary embodiment of thepresent disclosure.

The configuration of the computing device 100 illustrated in FIG. 1 ismerely a simplified example. In the exemplary embodiment of the presentdisclosure, the computing device 100 may include other configurationsfor performing a computing environment of the computing device 100, andonly some of the disclosed configurations may also configure thecomputing device 100.

According to the exemplary embodiment of the present disclosure, thecomputing device 100 may include a processor 110, a memory 130, and anetwork unit 150.

The processor 110 may be formed of one or more cores, and may include aprocessor, such as a central processing unit (CPU), a general purposegraphics processing unit (GPGPU), and a tensor processing unit (TPU) ofthe computing device, for performing a data analysis and deep learning.

The processor 110 may read a computer program stored in the memory 130and perform a data processing method according to an exemplaryembodiment of the present disclosure. According to the exemplaryembodiment of the present disclosure, the processor 110 may perform acomputation for training a neural network model. The processor 110 mayperform a calculation, such as processing of input data for learning inDeep Learning (DN), extraction of a feature from input data, an errorcalculation, and updating of a weight of the neural network by usingbackpropagation, for training the neural network. At least one of theCPU, GPGPU, and TPU of the processor 110 may process training of thenetwork function. For example, the CPU and the GPGPU may processtraining of the network function and data classification by using anetwork function together.

In the exemplary embodiment of the present disclosure, the training ofthe network function and the data classification by using a networkfunction may be processed by using the processors of the plurality ofcomputing devices together. Further, the computer program executed inthe computing device according to the exemplary embodiment of thepresent disclosure may be a CPU, GPGPU, or TPU executable program.

In the exemplary embodiment of the present disclosure, the computingdevice 100 may distribute and process the network function by using atleast one of a CPU, a GPGPU, or a TPU. Further, in the exemplaryembodiment of the present disclosure, the computing device 100 may alsodistribute and process the network function together with anothercomputing device. The description of specific contents for thedistribution and the processing of the network function of the computingdevice 100 is discussed in detail in U.S. patent application Ser. No.15/161,080 (filed on May 20, 2016) and Ser. No. 15/217,475 (filed onJul. 22, 2016) the entirety of which is incorporated by reference in thepresent application.

The processor 110 may acquire a data set including one or more pieces ofdata to be trained. In the exemplary embodiment of the presentdisclosure, the data processed by using the neural network model mayinclude all types of data acquired in industrial fields. For example,the data processed by using the neural network model may include anoperation parameter of a device for producing a product in a producingprocess of a product, sensor data acquired by an operation of a device,and the like. For example, in the case of a process setting atemperature of equipment and using a laser in a specific process, awavelength of the laser and the like may be included in the kind of dataprocessed in the present disclosure. For example, the processed data mayinclude lot equipment history data from a Management Execution System(MES), data from equipment interface data source, processing toolrecipes, processing tool test data, probe test data, electric test data,combination measurement data, diagnosis data, remote diagnosis data,post-processing data, and the like, and the present disclosure is notlimited thereto. As a more specific example, the processed data mayinclude work-inprogress information including about 120,000 items perlot acquired from a semiconductor fab, raw processing tool data,equipment interface information, process metrology information (forexample, including about 1,000 items per lot), defect informationaccessible by a yield-related engineer, operation test information, sortinformation (including datalog and bitmap), but the present disclosureis not limited thereto. The foregoing description of the kind of data ismerely illustrative, and the present disclosure is not limited thereto.

In the exemplary embodiment of the present disclosure, the computingdevice 100 may preprocess the collected data. The computing device 100may supplement a missing value among the collected data. For example,the computing device 100 may supplement a missing value with anintermediate value or an average value, or may also delete a columnincluding the plurality of missing values. For example, a subject matterexpertise of a manager may be utilized in the data preprocessing by thecomputing device 100 for matrix completion. For example, the computingdevice 100 may remove values that are completely out of bounds andlimits (for example, values estimated due to malfunctions of sensors)from the collected data. Further, the computing device 100 may adjust avalue of data so that the data has a similar scale while maintaining acharacteristic. The computing device 100 may apply, for example,standardization of data in the unit of column. The computing device 100may also simplify the processing by removing a column irrelevant to theprocessing of the neural network model from the data. In the exemplaryembodiment of the present disclosure, the computing device 100 mayperform an appropriate input data preprocessing method for easiness ofthe training of the neural network model for generating a classificationmodel and active learning. Descriptions of specific examples regardingthe types, examples, preprocessing, conversion, and the like of theinput data are specifically discussed in U.S. patent application Ser.No. 10/194,920 (filed on Jul. 12, 2002) the entirety of which isincorporated by reference in the present application.

The input data of the exemplary embodiment of the present disclosure mayinclude all types of data acquired in the industrial sites as describedabove. For example, the input data may include an operation parameter ofa device for producing a product in a producing process of a product,sensor data acquired by an operation of a device, and the like. Oneinput data may include data acquired while manufacturing a product usingone manufacturing recipe in one manufacturing equipment. The dataacquired while manufacturing the product may include sensor data. Thatis, an input data set including entire input data may include dataacquired while manufacturing a product by using one or moremanufacturing recipes in one or more manufacturing equipment (that is,data for various manufacturing equipment and various manufacturingrecipes may be mixed, so that the input data set may have multiplenormal states), but each input data is the data acquired in theproduction of the product by one manufacturing recipe in onemanufacturing equipment and may have one normal state.

In the exemplary embodiment of the present disclosure, the manufacturingequipment may include predetermined manufacturing equipment forproducing a product in an industrial site, and include, for example,semiconductor manufacturing equipment, but the present disclosure is notlimited thereto.

In the exemplary embodiment of the present disclosure, the manufacturingrecipe may be configured with a method of producing a product in anindustrial site, and more particularly, may include data for controllingmanufacturing equipment. In the exemplary embodiment of the presentdisclosure, the manufacturing recipe may include, for example, asemiconductor manufacturing recipe loaded to manufacturing equipment,but the present disclosure is not limited thereto.

The memory 130 may store a computer program for performing the dataprocessing method according to the exemplary embodiment of the presentdisclosure, and the stored computer program may be read and driven bythe processor 110.

The network unit 150 may transceive data for performing the dataprocessing method according to the exemplary embodiment of the presentdisclosure and the like with another computing device, a manufacturingdevice, a server, and the like. The network unit 150 may enablecommunication between a plurality of computing devices to enable theplurality of computing devices to perform distributed processing on dataprocessing using the neural network model.

The processor 110 may acquire a data set including one or more pieces ofdata to be trained. As described above, in the exemplary embodiment ofthe present disclosure, the data may include the predetermined types ofdata acquired in the industrial site, and the processor 110 may acquiredata from another computing device, manufacturing equipment, and thelike. One or more pieces of acquired data may configure a data set, andthe data set may be a set of data used in a computation of one epoch ofthe training of the neural network model.

The data set may include labeled data and unlabeled data. The unlabeleddata may be labeled by the data processing method of the exemplaryembodiment of the present disclosure, and the data processing method ofthe exemplary embodiment of the present disclosure may label unlabeleddata, thereby increasing a ratio of the labeled data included in thedata set and improving performance of the model.

That is, in an initial data set, only a part of the data may be labeled,but unlabeled data may be additionally labeled by the data processingmethod of the exemplary embodiment of the present disclosure.

A data subset is a subset of the data set and may include one or morepieces of data, and the data subset may be formed of the data selectedbased on a predetermined reference. In the present disclosure, the dataset may also be formed of only normal data. Each of the plurality ofdata subsets may include different data of a normal pattern. Forexample, the training data in the present disclosure may be sensor dataacquired in a semiconductor producing process and an operation parameterof producing equipment. In this case, when setting of the producingequipment in the semiconductor producing process (for example, a changein a wavelength of a laser emitted in a specific process) is changed(that is, the recipe is changed), sensor data acquired after the changein the setting may be included in a data subset that is different fromthat of the sensor data acquired before the change in the setting.

The processor 110 may select a plurality of different data in the dataset including the data formed of one or more feature groups. Theplurality of different data may be formed of data included in differentclusters.

The data may be formed of a plurality of items. Each of the plurality ofitems may be classified into the feature group according to apredetermined reference. The predetermined reference for classifying theplurality of items of the data into the feature group may be thepredetermined reference that may discriminate the value of the data fromanother value. In particular, the feature group may be formed ofassociated items among the plurality of items included in the data. Forexample, the data may be formed of the plurality of feature groups inwhich the values of the same form are grouped. Further, the data may beformed of the plurality of feature groups in which the values acquiredfrom the same sensor are grouped. Further, the data may be formed of theplurality of feature groups in which the values acquired from the samemonitoring module are grouped.

For particular example, the data may be formed of the plurality ofsensing values for the sensor data acquired in the semiconductorproducing process, the operation parameter of the producing equipment,and the like. The data may be formed of temperature sensor data, anglesensor data of a first joint of a robot's arm, angle sensor data of asecond joint of the robot's arm, and the like. In this case, forexample, the temperature sensor data may have a plurality of items whenthe plurality of temperature sensors is present. In this case, thetemperature sensor data may be classified into one feature group. Inthis case, the values of the temperature sensor data and the values ofthe angle sensor data of the first joint are formed of the differenttypes of values (that is, the values of the different units, such as atemperature and an angle), so that the values of the temperature sensordata and the values of the angle sensor data of the first joint may beclassified into different feature groups. Further, the value of theangle sensor data of the first joint and the value of the angle sensordata of the second joint are acquired from the different sensors ormonitoring modules, so that the value of the angle sensor data of thefirst joint and the value of the angle sensor data of the second jointmay be classified into the different feature groups. That is, the valuesof the temperature sensor data may be classified into a first featuregroup, the values of the angle sensor data of the first joint may beclassified into a second feature group, and the values of the anglesensor data of the second joint may be classified into a third featuregroup. That is, the values having the same types or acquired through thesame sensor or the same monitoring module are the correlated data, sothat the values may be classified into the same feature group. Theforegoing description of the temperature sensor data and the joint anglesensor data is merely illustrative, and the present disclosure is notlimited thereto.

In particular, referring to FIG. 2 , the processor 110 may select theplurality of different data from the data set 200 including the dataformed of one or more feature groups. For example, the processor 110 mayselect one or more data among the data included in a first data subset210 and one or more data among the data included in a second data subset220, which are classified into the different clusters. The data includedin the different clusters (that is, the data included in each datasubset) may be the data clustered based on the same reference.

For particular example, the data set including the plurality of data ofthe present disclosure may be sensor data acquired in a semiconductorproducing process and an operation parameter of producing equipment. Inthis case, when setting of the producing equipment (for example, achange in a wavelength of a laser emitted in a specific process) ischanged in the semiconductor producing process (that is, the recipe ischanged), sensor data acquired after the change in the setting may beincluded in a data subset that is different from that of the sensor dataacquired before the change in the setting. That is, the plurality ofdata included in the first data subset may be sensor data acquired atthe time before the change in the setting of the producing equipment ordata including information on the operation parameters of the producingequipment, and the plurality of data included in the second data subsetmay be sensor data acquired at the time after the change in the settingof the producing equipment or data including information related to theoperation parameters of the producing equipment. The foregoingparticular description of the data included in each data subset ismerely illustrative, and the present disclosure is not limited thereto.That is, the processor 110 may select the plurality of different datafrom each of the plurality of data subsets classified into the differentclusters. The processor 110 may generate the plurality of data subsetsby clustering the data of the data set. The plurality of data subsetsmay be classified, for example, by a classification model trained byusing a triplet loss-based cost function. Hereinafter, the method ofclustering the data of the data set into each of the plurality of datasubsets through the classification model will be described in detailwith reference to FIGS. 4 and 5 .

FIG. 4 is a schematic diagram illustrating a method of training aclassification model according to the exemplary embodiment of thepresent disclosure.

The classification model of the present disclosure may be trained by theprocessor 110 so as to form a cluster with similar data in a solutionspace 300. More particularly, the classification model may be trained sothat target data 301 and target similar data 302 are included in onecluster 310, and target dissimilar data 303 is included in a clusterthat is different from that of the target data 301 and the targetsimilar data 302. In the solution space of the trained classificationmodel, each cluster may be located to have a predetermined distancemargin 320.

The classification model may map each data to the solution space byreceiving a training data subset including the target data 301, thetarget similar data 302, and the target dissimilar data 303, and updatea weight of one or more network functions included in the classificationmodel so that the data is clustered according to the labeled clusterinformation in the solution space. That is, the classification model maybe trained so that a distance between the target data 301 and the targetsimilar data 302 and the target dissimilar data 303 is increased in thesolution space in order to decrease a distance between the target data301 and the target similar data 302 in the solution space. Theclassification model may be trained by using, for example, a tripletbased cost function. The triplet based cost function aims to separate apair of input data of the same classification from third input data ofanother classification, and a difference value between a first distance(that is, a size of the cluster 310) between the pair of input data ofthe same classification and a second distance (the distance between thetarget data 301 or the target similar data 302 and the target dissimilardata 303) between one of the pair of input data of the sameclassification and the third input data is set to at least a distancemargin 320, and the method of training the classification model includesdecreasing the first distance to a predetermined ratio of the distancemargin or less. Herein, the distance margin 320 may always be a positivenumber. The weight of one or more network functions included in theclassification model may be updated in order to reach the distancemargin 320, and the update of the weight may be performed for eachiteration or for each one epoch. The detailed contents for the distancemargin are disclosed in “FaceNet: A Unified Embedding for FaceRecognition and Clustering” of Schroff, etc., and Korean PatentApplication Laid-Open No. 10-2018-0068292) the entirety of which isincorporated by reference in the present specification.

The classification model may also be trained as a magnet loss-basedmodel that not only classifies dissimilar data into the cluster, butalso considers a semantic relationship between data in one cluster orbetween different clusters. An initial distance between the centerpoints of the respective clusters in the solution space of theclassification model may be corrected during the training process. Theclassification model may map the data to the solution space and thenadjust a location of each data in the solution space based on similaritywith the data of the cluster to which each data belongs, the data insidethe cluster, and the data outside the cluster. The detailed contentsrelated to the training of the classification model based on the magnetloss are disclosed in “METRIC LEARNING WITH ADAPTIVE DENSITYDISCRIMINATION” by O. Rippel the entirety of which is incorporated byreference in the present specification.

That is, the processor 110 may train the classification model so as toclassify the plurality of data included in the data set into theplurality of data subsets according to a specific cluster.

FIG. 5 is a schematic diagram illustrating a solution space of aclassification model a according to the exemplary embodiment of thepresent disclosure.

The solution space 300 illustrated in FIG. 5 is merely an example, andthe classification model may include the predetermined number ofclusters and the predetermined number of pieces of data for eachcluster. Shapes of the data 331, 333, 341, 343, and the like included inthe cluster illustrated in FIG. 5 are simply examples for representingthat the data are similar to each other.

In the present disclosure, the solution space may be formed of one ormore dimensional space and includes one or more clusters, and eachcluster may be formed based on the locations in the solution space ofcharacteristic data based on each target data and characteristic databased on target similar data.

In the solution space, the first cluster 330 and the second cluster 340may be the clusters for the dissimilar data. Further, the third cluster350 may be the cluster for the data dissimilar to the first and secondclusters. The distances 345 and 335 between the clusters may be measuresrepresenting the difference between the data included in the respectiveclusters.

The twelfth distance 345 between the first cluster 330 and the secondcluster 340 may be the measure representing the difference between thedata belonging to the first cluster 330 and the data belonging to thesecond cluster 340. Further, the thirteenth distance 335 between thefirst cluster 330 and the second cluster 340 may be the measurerepresenting the difference between the data belonging to the firstcluster 330 and the data belonging to the third cluster 350. In theexample illustrated in FIG. 5 , the data belonging to the first cluster330 may be more dissimilar to the data belonging to the second cluster340 than the data belonging to the third cluster 350. That is, when thedistance between the clusters is large, the data belonging to therespective clusters may be more dissimilar, and when the distancebetween the clusters is small, the data belonging to the respectiveclusters may be less dissimilar. The distances 335 and 345 between theclusters may be larger than a radius of the cluster by a predeterminedratio or more. The processor 110 may classify the input data based onthe location at which characteristic data of the input data is mapped inthe solution space of the classification model by computing the inputdata by using the classification model.

The processor 110 may map the characteristic data of the input data tothe solution space of the previously trained classification model byprocessing the input data by using the previously trained classificationmodel. The processor 110 may classify the input data based on a cluster,to which the input data belongs, among the one or more clusters in thesolution space based on the location of the input data in the solutionspace.

That is, the processor 110 may generate the plurality of data subsets byclustering the plurality of data included in the data set through thetrained classification model. For example, the processor 110 mayclassify the sensor data acquired at the time point before the change inthe setting of the producing equipment or the data related to theoperation parameter of the producing equipment among the plurality ofdata included in the data set through the trained classification modelinto the first data subset, and classify the sensor data acquired at thetime point after the change in the setting of the producing equipment orthe data related to the operation parameter of the producing equipmentinto the second data subset.

Accordingly, the processor 110 may classify the input data of theclassification model that is the model trained into the cluster throughthe triplet loss scheme and determine the different data having thenormal patterns as data for transformation.

According to the exemplary embodiment of the present disclosure, theprocessor 110 may determine data for performing transformation on a partof each data among the plurality of data. In particular, the processor110 may select data that may be utilized as valid data even after thetransformation of the data as data for performing transformation.Further, the processor 110 may select data that may be utilized as dataincluding an abnormal state after the transformation of the data as datafor performing transformation. Describing in more detail with referenceto FIG. 2 , the processor 110 may select the plurality of different datain each of the plurality of data subsets classified into the differentclusters as data for transforming the data. The processor 110 may selectone or more data among the data included in the first data subset 210,and select one or more data among the data included in the second datasubset 220. In this case, each of the first data subset 210 and thesecond data subset 220 may include information about the sensor dataacquired at the times before and after the change in the setting of theproducing equipment, respectively. That is, the processor 110 may selectfirst data 211 from the first data subset 210 and select third data 221from the second data subset 220 so that the data is valid as the datafor training even after the transformation of the data and is utilizedas abnormal data after the transformation.

The processor 110 may also select the plurality of different data fromthe data subset classified into the same cluster as data fortransforming the data. The processor 110 may also select the first data211 and the second data 212 included in the first data subset 210 thatis one cluster as data for transforming the data.

According to the exemplary embodiment of the present disclosure, theprocessor 110 may transform a part of each of the plurality of selecteddata. The processor 110 may change values of one or more feature groupof each data.

The processor 110 may exchange a value of one data among the pluralityof data and a value of another data. The plurality of data may include,for example, the first data and the second data. The processor 110 mayexchange a value of a part of the first data and a value of a part ofthe second data.

In particular, the processor 110 may exchange a value of one or morefeature groups of one data among the plurality of data and a value ofone or more feature groups of another data. The processor 110 mayexchange the values of the data corresponding to the same feature groupof the respective data. The processor 110 may exchange a value of thefirst feature group of the first data and a value of the first featuregroup of the second data. For example, the processor 110 may exchangethe values of the angle sensor feature group of the first joint of thefirst data and the values of the angle sensor feature group of the firstjoint of the second data. That is, the values of the associated featuregroups are exchanged, so that each data may be the data which is validitself but includes an abnormal state. For example, when the values ofthe feature groups that are not completely associated in two or moredata are exchanged, there is a possibility that the data itself is notvalid, and the data may also be determined as abnormal data by itself.That is, for example, in the case where the values of the feature grouprelated to an operation temperature included in the first data areexchanged with the values of the feature group related to an operationtime included in the second data, the data is not valid, so that thedata itself may be determined to be abnormal, and thus the data may notbe appropriate for training the model. That is, the data in which thevalues of the different feature groups are exchanged may be the datathat does not required much classification performance of the model.However, it is possible to generate the data which itself is valid, butis not in a normal state by exchanging the values included in theassociated feature groups. That is, it is possible to generate the datawhich is abnormal data, but requires much classification performance ofthe model by generating the data by exchanging the values included inthe associated feature groups. That is, the data having a lot ofknowledge with which the model is to be trained may be generated.

The feature groups selected from the data included in the differentclusters for the exchange may be the associated feature groups. Forexample, the feature groups selected for the exchange may be the commonitem in the data included in the different clusters. For example, in thecase where the two pieces of data are the data related to the operationof the same robot's arm, the feature group may correspond to each jointof the robot's arm. In this case, for example, the processor 110 mayexchange the values of the feature groups related to the same joint.

The associated feature group may be selected so as to generate validdata when the values of the feature groups are exchanged in the twopieces of data. For example, the feature groups selected in therespective data for the exchange may be the feature groups in which thetypes of values included in the corresponding feature groups andeffectiveness correspond to each other. For example, in the case wherethe two pieces of data are the data related to the operation of the samerobot's arm, the feature group may be each joint of the robot's arm.

In another example, the associated feature groups may also be selectedwith the feature groups in which the states of the data may be changedwhen the values of the feature groups are exchanged in the two pieces ofdata. In this case, as described above, the feature group may also beselected so that the data before and after the exchange is valid. Forexample, in the case where the two pieces of data are the data relatedto the operation of the same robot's arm, the feature group may be eachjoint of the robot's arm. Further, for example, the processor 110 mayexchange the values of the feature groups related to the differentjoints. That is, the processor 110 may also exchange the value of thefeature group related to the first joint in the first data and the valueof the feature group related to the second joint in the second data. Inthis case, all of the values of the feature group related to the firstjoint and the values of the feature group related to the second jointmay include the values related to the operation angles of the joints,and even though the data is generated by exchanging the values of thefeature groups by the foregoing method, the data may have the validform. The foregoing description is merely illustrative, and the presentdisclosure is not limited thereto.

For another example, the processor 110 may exchange the values of thefeature groups related to the different joints. By exchanging the valuesof the feature groups related to the different joints, in the case wherethe data before the exchange is normal state data, the data after theexchange may be in the abnormal state. Further, the values of thefeature groups corresponding in the respective data may also beexchanged. However, in this case, the state of the data may not bechanged according to the values included in other feature groups, sothat the processor 110 may also select the feature group so that thestate of the data is changed when the corresponding feature groups areexchanged for the training.

Describing in more detail with reference to FIG. 2 , the processor 110may select the plurality of pieces of different data from the pluralityof data subsets classified into the different clusters. The processor110 may select one or more data among the data included in the firstdata subset 210, and select one or more data among the data included inthe second data subset 220. In this case, each of the first data subset210 and the second data subset 220 may include information about thesensor data acquired at the times before and after the change in thesetting of the producing equipment, respectively. When the second data212 is selected from the first data subset 210 and the fourth data 222is selected from the second data subset 220, the processor 110 maychange the value of one feature group among the one or more featuregroups included in each of the second data 212 and the fourth data 222.The processor 110 may transform the value of each feature group byexchanging 21 the value of the first feature group among the pluralityof feature groups included in the second data 212 and the value of thefirst feature group among the plurality of feature groups included inthe fourth data 222. That is, the processor 110 may transform a part ofeach of the plurality of selected data by selecting the data included ineach data subset forming the different cluster and exchanging the valuesof the data belonging to the same feature group of each selected data.In this case, the transformation of each of the selected data may beperformed through the exchange of the values of the data belonging tothe same feature group (that is, the exchange of the data values havingthe association).

The processor 110 may also select two or more data included in the samedata subset and change the values of the two or more data. For example,the processor 110 may select the first data 211 and the second data 212included in the first data subset 210 and generate new data byexchanging 22 the data of the first feature group of the first data 211and the data of the first feature group of the second data 212. Further,the data generated in this case may also be normal or abnormal accordingto the values included in another feature group. In the foregoingexample, according to the values included in the second and thirdfeature groups, the first data 211 in which the value of the firstfeature group is changed to the value of the first feature group of thesecond data 212 may be normal data or abnormal data.

For another example, the processor 110 may select the first data 211 andthe second data 212 included in the first data subset 210 and generatenew data by exchanging 23 the first feature group of the first data 211and the second feature group of the second data 212. In this case, thefirst feature group of the first data 211 may be the feature groupconsisting of the values related to the angle sensing data of the firstjoint, and the second feature group of the second data 212 may be thefeature group consisting of the values related to the angle sensing dataof the second joint. For example, when the first joint and the secondjoint have the similar specifications and the operation ranges thereofcorrespond to each other, the valid data may also be generated. That is,the processor 110 transforms the data through the exchange 23 betweenthe feature groups having the association (that is, the feature groupsconsisting of the values related to the angle sensing data of the joint)even though the feature groups are not completely same, such that aprobability that the data is valid is high and the data may betransformed to data including an abnormal state.

Accordingly, as a result of the performance of the operation ofselecting the plurality of data and exchanging the values of the featuregroups of each data by the processor 110, the normal data included ineach data may be transformed to abnormal data. Further, the abnormaldata transformed by the processor 110 is not generated through theexchange of the normal data including the different manufacturingrecipes, but is generated through the exchange of the same feature groupof the respective normal data having the association, so that theabnormal data may be utilized as data for training and testing theneural network. That is, the processor 110 may additionally generateabnormal data for training or testing the neural network through thetransformation of each of the plurality of data.

According to the exemplary embodiment of the present disclosure, theprocessor 110 may assign a label to each of the plurality of transformeddata. The processor 110 may assign an abnormal label to each of theplurality of transformed data. In particular, the processor 110 mayselect the plurality of data from each of the plurality of data subsetsforming the different clusters, and generate abnormal data through thetransformation of a part of each of the plurality of data selected byexchanging the values of the data belonging to the same feature group ofeach selected data. Further, the processor 110 may assign a pseudoabnormal label to each of the plurality of generated abnormal data. Thepseudo abnormal label may be a hard label or a soft label. The pseudoabnormal label may be, for example, a label representing that thecorresponding data is abnormal, and may also represent a probabilitythat the corresponding data is abnormal (for example, a value obtainedin consideration of a ratio of the changed feature group occupied in thedata). The foregoing description is merely illustrative, and the presentdisclosure is not limited thereto.

For example, the processor 110 may select the first data and the seconddata from the data set including the plurality of data, and exchange thespecific feature groups of the first data and the second data. In thiscase, the first data includes a value of the specific feature group ofthe second data and the second data includes a value of the specificfeature group corresponding to the first data, so that each transformeddata may be abnormal data. In this case, the processor 110 may assignthe label that is the pseudo abnormal data to each data. The particulardescription for the process of generating abnormal data through eachdata is merely illustrative, and the present disclosure is not limitedthereto.

That is, the processor 110 exchanges one or more feature groups includedin each of the plurality of data and assigns the pseudo abnormal labelto each of the transformed data (that is, each abnormal data), therebytraining the model so that the model detects whether the data isabnormal.

In general, the neural network model for detecting an anomaly based onspecific data may be pre-trained through training data including normaldata and abnormal data. That is, in the process of pre-training theneural network model so that the model detects whether the data isabnormal, both normal data and abnormal data need to be constructed.However, the abnormal data for training the neural network includestime-series information, so that it is difficult to secure (orconstruct) the abnormal data, and lots of time may be required forconstructing the corresponding abnormal data. In the present disclosure,it is possible to generate abnormal data by transforming data byexchanging the same feature group of each normal data, so that it is notnecessary to separately construct abnormal data, thereby being easy toconstruct training data. Further, the abnormal data generated bytransforming the plurality of data of the present disclosure isgenerated through the exchange of the values of the data belonging tothe same feature group (that is, the exchange of the data values havingthe association), not through the simple transformation of a partialportion of each data to a different value (for example, addition noiseto specific data), so that it is possible to generate training dataappropriate to train the neural network (for example, the anomalydetection model).

According to the exemplary embodiment of the present disclosure, theprocessor 110 may compute the transformed data by using the model. Inthe exemplary embodiment of the present disclosure, the model may beused for detecting anomaly. The processor 110 may test performance ofthe model by computing the transformed data by using the model. Theprocessor 110 may test performance of the model based on whether themodel determines the transformed data to be abnormal. For example, theprocessor 110 may transform the first data and the second data byexchanging the first feature groups among the plurality of featuregroups included in the first data and the second data. Further, theprocessor 110 may output whether each data is an anomaly by using eachof the transformed first data and second data (that is, abnormal data)as an input of the model. When the output result of the model includesinformation that the anomaly is detected in the first data andinformation that the anomaly is detected in the second data, theprocessor 110 may determine that performance of the corresponding modelis appropriate.

For another example, when the output result of the model includesinformation that the anomaly is not detected in at least one databetween the first data and the second data, the processor 110 maydetermine that performance of the corresponding model is inappropriate.The particular description for whether the anomaly is detected outputbased on the first data and the second data is merely illustrative, andthe present disclosure is not limited thereto.

That is, a test of performance of the neural network model that istrained in an environment in which a text data set is not constructedmay be possible. That is, even though a separate test set for testingthe trained neural network model is not constructed, it is possible toperform a test for the trained neural network model by generatingabnormal data through the transformation of the plurality of data.

Accordingly, it is not necessary to separately construct a test set,training of the neural network and performance test are simplified,thereby improving efficiency of the generation of the neural networkmodel detecting anomaly (that is, anomaly detecting model).

FIG. 3 is a schematic diagram illustrating a network function accordingto the exemplary embodiment of the present disclosure.

Throughout the present specification, a computation model, a nervenetwork, the network function, and the neural network may be used withthe same meaning. The neural network may be formed of a set ofinterconnected calculation units which are generally referred to as“nodes.” The “nodes” may also be called “neurons.” The neural networkconsists of one or more nodes. The nodes (or neurons) configuring theneural network may be interconnected by one or more “links.”

In the neural network, one or more nodes connected through the links mayrelatively form a relationship of an input node and an output node. Theconcept of the input node is relative to the concept of the output node,and a predetermined node having an output node relationship with respectto one node may have an input node relationship in a relationship withanother node, and a reverse relationship is also available. As describedabove, the relationship between the input node and the output node maybe generated based on the link. One or more output nodes may beconnected to one input node through a link, and a reverse case may alsobe valid.

In the relationship between an input node and an output node connectedthrough one link, a value of the output node may be determined based ondata input to the input node. Herein, a node connecting the input nodeand the output node may have a weight. The weight is variable, and inorder for the neural network to perform a desired function, the weightmay be varied by a user or an algorithm. For example, when one or moreinput nodes are connected to one output node by links, respectively, avalue of the output node may be determined based on values input to theinput nodes connected to the output node and weights set in the linkcorresponding to each of the input nodes.

As described above, in the neural network, one or more nodes areconnected with each other through one or more links to form arelationship of an input node and an output node in the neural network.A characteristic of the neural network may be determined according tothe number of nodes and links in the neural network, a correlationbetween the nodes and the links, and a value of the parameter assignedto each of the links. For example, when there are two neural networks inwhich the numbers of nodes and links are the same and the weightsbetween the links are different, the two neural networks may berecognized to be different from each other.

The neural network may consist of one or more nodes. Some of the nodesconfiguring the neural network may form one layer based on distancesfrom an initial input node. For example, a set of nodes having adistance of n from an initial input node may form n layers. The distancefrom the initial input node may be defined by the minimum number oflinks, which needs to be passed from the initial input node to acorresponding node. However, the definition of the layer is arbitraryfor the description, and a degree of the layer in the neural network maybe defined by a different method from the foregoing method. For example,the layers of the nodes may be defined by a distance from a final outputnode.

The initial input node may mean one or more nodes to which data isdirectly input without passing through a link in a relationship withother nodes among the nodes in the neural network. Otherwise, theinitial input node may mean nodes which are not included in other inputnodes connected through the links in a relationship between the nodesbased on the link in the neural network. Similarly, the final outputnode may mean one or more nodes which do not have an output node in arelationship with other nodes among the nodes in the neural network.Further, the hidden node may mean nodes configuring the neural network,not the initial input node and the final output node. In the neuralnetwork according to the exemplary embodiment of the present disclosure,the number of nodes of the input layer may be the same as the number ofnodes of the output layer, and the neural network may be in the formthat the number of nodes decreases and then increases again from theinput layer to the hidden layer. Further, in the neural networkaccording to another exemplary embodiment of the present disclosure, thenumber of nodes of the input layer may be smaller than the number ofnodes of the output layer, and the neural network may be in the formthat the number of nodes decreases from the input layer to the hiddenlayer. Further, in the neural network according to another exemplaryembodiment of the present disclosure, the number of nodes of the inputlayer may be larger than the number of nodes of the output layer, andthe neural network may be in the form that the number of nodes increasesfrom the input layer to the hidden layer. The neural network accordingto another exemplary embodiment of the present disclosure may be theneural network in the form in which the foregoing neural networks arecombined.

A deep neural network (DNN) may mean the neural network including aplurality of hidden layers, in addition to an input layer and an outputlayer. When the DNN is used, it is possible to recognize a latentstructure of data. That is, it is possible to recognize the latentstructures of pictures, texts, videos, voices, and music (for example,an object included in the picture, the contents and the emotion of thetext, and the contents and the emotion of the voice). The DNN mayinclude a convolutional neural network (CNN), a recurrent neural network(RNN), an auto encoder, Generative Adversarial Networks (GAN), arestricted Boltzmann machine (RBM), a deep belief network (DBN), a Qnetwork, a U network, Siamese network, and the like. The foregoingdescription of the deep neural network is merely illustrative, and thepresent disclosure is not limited thereto.

In the exemplary embodiment of the present disclosure, the networkfunction may include an auto encoder. The auto encoder may be one typeof artificial neural network for outputting output data similar to inputdata. The auto encoder may include at least one hidden layer, and theodd-numbered hidden layers may be disposed between the input/outputlayers. The number of nodes of each layer may decrease from the numberof nodes of the input layer to an intermediate layer called a bottlenecklayer (encoding), and then be expanded symmetrically with the decreasefrom the bottleneck layer to the output layer (symmetric with the inputlayer). In this case, in the example of FIG. 3 , the dimension reductionlayer and the dimension restoration layer are illustrative to besymmetric, but the present disclosure is not limited thereto, and thenodes of a dimension reduction layer may or may not be symmetric to thenodes of a dimension restoration layer. The auto encoder may perform anonlinear dimension reduction. The number of input layers and the numberof output layers may correspond to the number of sensors left afterpreprocessing of the input data. In the auto encoder structure, thenumber of nodes of the hidden layer included in the encoder decreases asa distance from the input layer increases. When the number of nodes ofthe bottleneck layer (the layer having the smallest number of nodeslocated between the encoder and the decoder) is too small, thesufficient amount of information may not be transmitted, so that thenumber of nodes of the bottleneck layer may be maintained in a specificnumber or more (for example, a half or more of the number of nodes ofthe input layer and the like).

The neural network may be learned by at least one scheme of supervisedlearning, unsupervised learning, and semi-supervised learning. Thelearning of the neural network is for the purpose of minimizing an errorof an output. In the training of the neural network, training data isrepeatedly input to the neural network and an error of an output of theneural network for the training data and a target is calculated, and theerror of the neural network is back-propagated in a direction from anoutput layer to an input layer of the neural network in order todecrease the error, and a weight of each node of the neural network isupdated. In the case of the supervised learning, training data labelledwith a correct answer (that is, labelled training data) is used, in eachtraining data, and in the case of the unsupervised learning, a correctanswer may not be labelled to each training data. That is, for example,the training data in the supervised learning for data classification maybe data, in which category is labelled to each of the training data. Thelabelled training data is input to the neural network and the output(category) of the neural network is compared with the label of thetraining data to calculate an error. For another example, in the case ofthe unsupervised learning related to the data classification, trainingdata that is the input is compared with an output of the neural network,so that an error may be calculated. The calculated error isback-propagated in a reverse direction (that is, the direction from theoutput layer to the input layer) in the neural network, and a weight ofeach of the nodes of the layers of the neural network may be updatedaccording to the backpropagation. A variation rate of the updated weightof each node may be determined according to a learning rate. Thecalculation of the neural network for the input data and thebackpropagation of the error may configure a learning epoch. Thelearning rate is differently applicable according to the number of timesof repetition of the learning epoch of the neural network. For example,at the initial stage of the learning of the neural network, a highlearning rate is used to make the neural network rapidly secureperformance of a predetermined level and improve efficiency, and at thelatter stage of the learning, a low learning rate is used to improveaccuracy.

In the learning of the neural network, the training data may begenerally a subset of actual data (that is, data to be processed byusing the learned neural network), and thus an error for the trainingdata is decreased, but there may exist a learning epoch, in which anerror for the actual data is increased. Overfitting is a phenomenon, inwhich the neural network excessively learns training data, so that anerror for actual data is increased. For example, a phenomenon, in whichthe neural network learning a cat while seeing a yellow cat cannotrecognize cats, other than a yellow cat, as cats, is a sort ofoverfitting. Overfitting may act as a reason of increasing an error of amachine learning algorithm. In order to prevent overfitting, variousoptimizing methods may be used. In order to prevent overfitting, amethod of increasing training data, a regularization method, a dropoutmethod of omitting a part of nodes of the network during the learningprocess, and the like may be applied.

According to the exemplary embodiment of the present disclosure, acomputer readable medium storing a data structure is disclosed.

The data structure may refer to organization, management, and storage ofdata that enable efficient access and modification of data. The datastructure may refer to organization of data for solving a specificproblem (for example, data search, data storage, and data modificationin the shortest time). The data structure may also be defined with aphysical or logical relationship between the data elements designed tosupport a specific data processing function. The logical relationshipbetween the data elements may include a connection relationship betweenthe data elements that the user thinks. The physical relationshipbetween the data elements may include an actual relationship between thedata elements physically stored in a computer readable storage medium(for example, a hard disk). In particular, the data structure mayinclude a set of data, a relationship between data, and a function or acommand applicable to data. Through the effectively designed datastructure, the computing device may perform a computation whileminimally using resources of the computing device. In particular, thecomputing device may improve efficiency of computation, reading,insertion, deletion, comparison, exchange, and search through theeffectively designed data structure.

The data structure may be divided into a linear data structure and anon-linear data structure according to the form of the data structure.The linear data structure may be the structure in which only one data isconnected after one data. The linear data structure may include a list,a stack, a queue, and a deque. The list may mean a series of dataset inwhich order exists internally. The list may include a linked list. Thelinked list may have a data structure in which each data has a pointerand is linked in a single line. In the linked list, the pointer mayinclude information about the connection with the next or previous data.The linked list may be expressed as a single linked list, a doublelinked list, and a circular linked list according to the form. The stackmay have a data listing structure with limited access to data. The stackmay have a linear data structure that may process (for example, insertor delete) data only at one end of the data structure. The data storedin the stack may have a data structure (Last In First Out, LIFO) inwhich the later the data enters, the sooner the data comes out. Thequeue is a data listing structure with limited access to data, and mayhave a data structure (First In First Out, FIFO) in which the later thedata is stored, the later the data comes out, unlike the stack. Thedeque may have a data structure that may process data at both ends ofthe data structure.

The non-linear data structure may be the structure in which theplurality of pieces of data is connected after one data. The non-lineardata structure may include a graph data structure. The graph datastructure may be defined with a vertex and an edge, and the edge mayinclude a line connecting two different vertexes. The graph datastructure may include a tree data structure. The tree data structure maybe the data structure in which a path connecting two different vertexesamong the plurality of vertexes included in the tree is one. That is,the tree data structure may be the data structure in which a loop is notformed in the graph data structure.

Throughout the present specification, a computation model, a nervenetwork, the network function, and the neural network may be used withthe same meaning (hereinafter, the present disclosure will be describedbased on the unification to the neural network). The data structure mayinclude a neural network. Further, the data structure including theneural network may be stored in a computer readable medium. The datastructure including the neural network may also include data input tothe neural network, a weight of the neural network, a hyper-parameter ofthe neural network, data obtained from the neural network, an activefunction associated with each node or layer of the neural network, and aloss function for training of the neural network. The data structureincluding the neural network may include predetermined configurationelements among the disclosed configurations. That is, the data structureincluding the neural network may be formed of the entirety or apredetermined combination of data input to the neural network, a weightof the neural network, a hyper parameter of the neural network, dataobtained from the neural network, an active function associated witheach node or layer of the neural network, and a loss function fortraining of the neural network. In addition to the foregoingconfigurations, the data structure including the neural network mayinclude predetermined other information determining a characteristic ofthe neural network. Further, the data structure may include all type ofdata used or generated in a computation process of the neural network,and is not limited to the foregoing matter. The computer readable mediummay include a computer readable recording medium and/or a computerreadable transmission medium. The neural network may be formed of a setof interconnected calculation units which are generally referred to as“nodes.” The “nodes” may also be called “neurons.” The neural networkconsists of one or more nodes.

The data structure may include data input to the neural network. Thedata structure including the data input to the neural network may bestored in the computer readable medium. The data input to the neuralnetwork may include training data input in the training process of theneural network and/or input data input to the training completed neuralnetwork. The data input to the neural network may include data that hasundergone pre-processing and/or data to be pre-processed. Thepre-processing may include a data processing process for inputting datato the neural network. Accordingly, the data structure may include datato be pre-processed and data generated by the pre-processing. Theforegoing data structure is merely an example, and the presentdisclosure is not limited thereto.

The data structure may include a weight of the neural network (in thepresent specification, a weight and a parameter may be used as the samemeaning). Further, the data structure including the weight of the neuralnetwork may be stored in the computer readable medium. The neuralnetwork may include a plurality of weights. The weight is variable, andin order for the neural network to perform a desired function, theweight may be varied by a user or an algorithm. For example, when one ormore input nodes are connected to one output node by links,respectively, a value of the output node may be determined based onvalues input to the input nodes connected to the output node and theparameter set in the link corresponding to each of the input nodes. Theforegoing data structure is merely an example, and the presentdisclosure is not limited thereto.

For a non-limited example, the weight may include a weight varied in theneural network training process and/or the weight of the trainingcompleted neural network. The weight varied in the neural networktraining process may include a weight at a time at which a trainingcycle starts and/or a weight varied during a training cycle. The weightof the training completed neural network may include a weight of theneural network completing the training cycle. Accordingly, the datastructure including the weight of the neural network may include thedata structure including the weight varied in the neural networktraining process and/or the weight of the training completed neuralnetwork. Accordingly, it is assumed that the weight and/or a combinationof the respective weights are included in the data structure includingthe weight of the neural network. The foregoing data structure is merelyan example, and the present disclosure is not limited thereto.

The data structure including the weight of the neural network may bestored in the computer readable storage medium (for example, a memoryand a hard disk) after undergoing a serialization process. Theserialization may be the process of storing the data structure in thesame or different computing devices and converting the data structureinto a form that may be reconstructed and used later. The computingdevice may serialize the data structure and transceive the data througha network. The serialized data structure including the weight of theneural network may be reconstructed in the same or different computingdevices through deserialization. The data structure including the weightof the neural network is not limited to the serialization. Further, thedata structure including the weight of the neural network may include adata structure (for example, in the non-linear data structure, B-Tree,Trie, m-way search tree, AVL tree, and Red-Black Tree) for improvingefficiency of the computation while minimally using the resources of thecomputing device. The foregoing matter is merely an example, and thepresent disclosure is not limited thereto.

The data structure may include a hyper-parameter of the neural network.The data structure including the hyper-parameter of the neural networkmay be stored in the computer readable medium. The hyper-parameter maybe a variable varied by a user. The hyper-parameter may include, forexample, a learning rate, a cost function, the number of times ofrepetition of the training cycle, weight initialization (for example,setting of a range of a weight to be weight-initialized), and the numberof hidden units (for example, the number of hidden layers and the numberof nodes of the hidden layer). The foregoing data structure is merely anexample, and the present disclosure is not limited thereto.

FIG. 6 is a flowchart for performing data processing according to anexemplary embodiment of the present disclosure.

According to the exemplary embodiment of the present disclosure, thecomputing device 100 may select a plurality of different data from adata set including data formed of one or more feature groups (410).

According to the exemplary embodiment of the present disclosure, thecomputing device 100 may transform a part of each data among theplurality of selected data (420).

According to the exemplary embodiment of the present disclosure, thecomputing device 100 may assign a label to each of the plurality oftransformed data (430).

According to the exemplary embodiment of the present disclosure, thecomputing device 100 may compute the transformed data by using the model(440).

An order of the operations illustrated in FIG. 6 may be changed asnecessary, and one or more operations may be omitted or added. That is,the foregoing operations are merely the exemplary embodiment of thepresent disclosure, and the scope of the present disclosure is notlimited thereto.

FIG. 7 is a diagram illustrating logic for implementing a method ofperforming data processing according to an exemplary embodiment of thepresent disclosure.

According to the exemplary embodiment of the present disclosure, thecomputing device 100 may be implemented by logic below.

According to the exemplary embodiment of the present disclosure, thecomputing device 100 may include logic 510 for selecting a plurality ofdifferent data from a data set including data formed of one or morefeature groups, logic 520 for transforming a part of each data among theplurality of selected data, logic 530 for assigning a label to each ofthe plurality of transformed data, and logic 540 for computing thetransformed data by using the model.

In an alternative exemplary embodiment, the plurality of different datamay be formed of data included in the same cluster or differentclusters.

In the alternative exemplary embodiment, the computing device 100 mayfurther include logic for generating a plurality of data subsets byclustering the data of the data set.

In the alternative exemplary embodiment, the logic for generating theplurality of data subsets by clustering the data of the data set may beperformed by a classification model trained by using a tripletloss-based cost function.

In the alternative exemplary embodiment, each of the plurality of datasubsets may include different data of a normal pattern.

In the alternative exemplary embodiment, the logic for transforming thepart of each data among the plurality of selected data may include logicfor changing a value of one feature group among the one or more featuregroups of each data.

In the alternative exemplary embodiment, the logic for transforming thepart of each data among the plurality of selected data may include logicfor exchanging a value of one data among the plurality of data with avalue of another data.

In the alternative exemplary embodiment, the logic for exchanging thevalue of one data among the plurality of data with the value of anotherdata may include logic for exchanging a value of one or more featuregroups of one data among the plurality of data with a value of one ormore feature groups of another data.

In the alternative exemplary embodiment, the logic for exchanging thevalue of one data among the plurality of data with the value of anotherdata may include logic for exchanging values of the data belonging tothe same feature group of each data.

In the alternative exemplary embodiment, the data included in the dataset may be normal data.

In the alternative exemplary embodiment, the logic for assigning thelabel to each of the plurality of transformed data may include logic forassigning an abnormal label to each of the plurality of transformeddata.

In the alternative exemplary embodiment, the logic for computing thetransformed data by using the model may include logic for testingperformance of the model by computing the transformed data by using themodel.

In the alternative exemplary embodiment, the logic for testingperformance of the model by computing the transformed data by using themodel may include logic for testing performance of the model based onwhether the model determines the transformed data to be abnormal.

In the alternative exemplary embodiment, each of the feature groups maybe formed of associated items among the plurality of items included inthe data.

According to the exemplary embodiment of the present disclosure, thelogic for implementing the computing device 100 may be implemented bymeans, circuits, or modules for implementing the computing program.

Those skilled in the art shall recognize that the various illustrativelogical blocks, configurations, modules, circuits, means, logic, andalgorithm operations described in relation to the exemplary embodimentsadditionally disclosed herein may be implemented by electronic hardware,computer software, or in a combination of electronic hardware andcomputer software. In order to clearly exemplify interchangeability ofhardware and software, the various illustrative components, blocks,configurations, means, logic, modules, circuits, and operations havebeen generally described above in the functional aspects thereof.Whether the functionality is implemented as hardware or software dependson a specific application or design restraints given to the generalsystem. Those skilled in the art may implement the functionalitydescribed by various methods for each of the specific applications.However, it shall not be construed that the determinations of theimplementation deviate from the range of the contents of the presentdisclosure.

FIG. 8 is a simple and general schematic diagram illustrating an exampleof a computing environment in which exemplary embodiments of the presentdisclosure are implementable.

The present disclosure has been generally described in relation to acomputer executable command executable in one or more computers, butthose skilled in the art will appreciate well that the presentdisclosure is combined with other program modules and/or be implementedby a combination of hardware and software.

In general, a program module includes a routine, a procedure, a program,a component, a data structure, and the like performing a specific taskor implementing a specific abstract data form. Further, those skilled inthe art will appreciate well that the method of the present disclosuremay be carried out by a personal computer, a hand-held computing device,a microprocessor-based or programmable home appliance (each of which maybe connected with one or more relevant devices and be operated), andother computer system configurations, as well as a single-processor ormultiprocessor computer system, a mini computer, and a main framecomputer.

The exemplary embodiments of the present disclosure may be carried outin a distribution computing environment, in which certain tasks areperformed by remote processing devices connected through a communicationnetwork. In the distribution computing environment, a program module maybe positioned in both a local memory storage device and a remote memorystorage device.

The computer generally includes various computer readable media. Anykind of computer accessible medium may be the computer readable medium,and the computer readable medium may include a computer readable storagemedium and a computer readable transmission medium. The computerreadable storage medium may include a volatile and non-volatile media,and transitory and non-transitory media. The computer readable storagemedium includes volatile and non-volatile media, and portable andnon-portable media implemented with a predetermined method ortechnology, which stores information, such as a computer readablecommand, a data structure, a program module, or other data. The computerreadable storage medium includes a Random Access Memory (RAM), a ReadOnly Memory (ROM), an Electrically Erasable and Programmable ROM(EEPROM), a flash memory, or other memory technologies, a Compact Disc(CD)-ROM, a Digital Video Disk (DVD), or other optical disk storagedevices, a magnetic cassette, a magnetic tape, a magnetic disk storagedevice, or other magnetic storage device, or other predetermined media,which are accessible by a computer and are used for storing desiredinformation, but is not limited thereto.

The computer readable transport medium includes information transportmedia implementing a computer readable command, a data structure, aprogram module, or other data in a modulated data signal, such as acarrier wave or other transport mechanisms. The modulated data signalmeans a signal, of which one or more of the characteristics are set orchanged so as to encode information within the signal. As a non-limitedexample, the computer readable transport medium includes a wired medium,such as a wired network or a direct-wired connection, and a wirelessmedium, such as sound, radio frequency (RF), infrared rays, and otherwireless media. A combination of the predetermined media among theforegoing media is also included in a range of the computer readabletransport medium.

An illustrative environment 1100 including a computer 1102 andimplementing several aspects of the present disclosure is illustrated,and the computer 1102 includes a processing device 1104, a system memory1106, and a system bus 1108. The system bus 1108 connects systemcomponents including the system memory 1106 (not limited) to theprocessing device 1104. The processing device 1104 may be apredetermined processor among various commonly used processors 110. Adual processor and other multi-processor architectures may also be usedas the processing device 1104.

The system bus 1108 may be a predetermined one among several types ofbus structure, which may be additionally connectable to a local bususing a predetermined one among a memory bus, a peripheral device bus,and various common bus architectures. The system memory 1106 includes aROM 1110, and a RAM 1112. A basic input/output system (BIOS) is storedin a non-volatile memory 1110, such as a ROM, an erasable andprogrammable ROM (EPROM), and an EEPROM, and the BIOS includes a basicrouting helping a transport of information among the constituentelements within the computer 1102 at a time, such as starting. The RAM1112 may also include a high-rate RAM, such as a static RAM, for cachingdata.

The computer 1102 also includes an embedded hard disk drive (HDD) 1114(for example, enhanced integrated drive electronics (EIDE) and serialadvanced technology attachment (SATA))—the embedded HDD 1114 beingconfigured for outer mounted usage within a proper chassis (notillustrated)—a magnetic floppy disk drive (FDD) 1116 (for example, whichis for reading data from a portable diskette 1118 or recording data inthe portable diskette 1118), and an optical disk drive 1120 (forexample, which is for reading a CD-ROM disk 1122, or reading data fromother high-capacity optical media, such as a DVD, or recording data inthe high-capacity optical media). A hard disk drive 1114, a magneticdisk drive 1116, and an optical disk drive 1120 may be connected to asystem bus 1108 by a hard disk drive interface 1124, a magnetic diskdrive interface 1126, and an optical drive interface 1128, respectively.An interface 1124 for implementing an outer mounted drive includes, forexample, at least one of or both a universal serial bus (USB) and theInstitute of Electrical and Electronics Engineers (IEEE) 1394 interfacetechnology.

The drives and the computer readable media associated with the drivesprovide non-volatile storage of data, data structures, computerexecutable commands, and the like. In the case of the computer 1102, thedrive and the medium correspond to the storage of random data in anappropriate digital form. In the description of the computer readablestorage media, the HDD, the portable magnetic disk, and the portableoptical media, such as a CD, or a DVD, are mentioned, but those skilledin the art will well appreciate that other types of computer readablemedia, such as a zip drive, a magnetic cassette, a flash memory card,and a cartridge, may also be used in the illustrative operationenvironment, and the predetermined medium may include computerexecutable commands for performing the methods of the presentdisclosure.

A plurality of program modules including an operation system 1130, oneor more application programs 1132, other program modules 1134, andprogram data 1136 may be stored in the drive and the RAM 1112. Anentirety or a part of the operation system, the application, the module,and/or data may also be cached in the RAM 1112. It will be appreciatedwell that the present disclosure may be implemented by severalcommercially usable operation systems or a combination of operationsystems.

A user may input a command and information to the computer 1102 throughone or more wired/wireless input devices, for example, a keyboard 1138and a pointing device, such as a mouse 1140. Other input devices (notillustrated) may be a microphone, an IR remote controller, a joystick, agame pad, a stylus pen, a touch screen, and the like. The foregoing andother input devices are frequently connected to the processing device1104 through an input device interface 1142 connected to the system bus1108, but may be connected by other interfaces, such as a parallel port,an IEEE 1394 serial port, a game port, a USB port, an IR interface, andother interfaces.

A monitor 1144 or other types of display devices are also connected tothe system bus 1108 through an interface, such as a video adaptor 1146.In addition to the monitor 1144, the computer generally includes otherperipheral output devices (not illustrated), such as a speaker and aprinter.

The computer 1102 may be operated in a networked environment by using alogical connection to one or more remote computers, such as remotecomputer(s) 1148, through wired and/or wireless communication. Theremote computer(s) 1148 may be a work station, a server computer, arouter, a personal computer, a portable computer, a microprocessor-basedentertainment device, a peer device, and other general network nodes,and generally includes some or an entirety of the constituent elementsdescribed for the computer 1102, but only a memory storage device 1150is illustrated for simplicity. The illustrated logical connectionincludes a wired/wireless connection to a local area network (LAN) 1152and/or a larger network, for example, a wide area network (WAN) 1154.The LAN and WAN networking environments are general in an office and acompany, and make an enterprise-wide computer network, such as anIntranet, easy, and all of the LAN and WAN networking environments maybe connected to a worldwide computer network, for example, Internet.

When the computer 1102 is used in the LAN networking environment, thecomputer 1102 is connected to the local network 1152 through a wiredand/or wireless communication network interface or an adaptor 1156. Theadaptor 1156 may make wired or wireless communication to the LAN 1152easy, and the LAN 1152 also includes a wireless access point installedtherein for the communication with the wireless adaptor 1156. When thecomputer 1102 is used in the WAN networking environment, the computer1102 may include a modem 1158, is connected to a communication server ona WAN 1154, or includes other means setting communication through theWAN 1154 via the Internet. The modem 1158, which may be an embedded orouter-mounted and wired or wireless device, is connected to the systembus 1108 through a serial port interface 1142. In the networkedenvironment, the program modules described for the computer 1102 or someof the program modules may be stored in a remote memory/storage device1150. The illustrated network connection is illustrative, and thoseskilled in the art will appreciate well that other means setting acommunication link between the computers may be used.

The computer 1102 performs an operation of communicating with apredetermined wireless device or entity, for example, a printer, ascanner, a desktop and/or portable computer, a portable data assistant(PDA), a communication satellite, predetermined equipment or placerelated to a wirelessly detectable tag, and a telephone, which isdisposed by wireless communication and is operated. The operationincludes a wireless fidelity (Wi-Fi) and Bluetooth wireless technologyat least. Accordingly, the communication may have a pre-definedstructure, such as a network in the related art, or may be simply ad hoccommunication between at least two devices.

The Wi-Fi enables a connection to the Internet and the like even withouta wire. The Wi-Fi is a wireless technology, such as a cellular phone,which enables the device, for example, the computer, to transmit andreceive data indoors and outdoors, that is, in any place within acommunication range of a base station. A Wi-Fi network uses a wirelesstechnology, which is called IEEE 802.11 (a, b, g, etc.) for providing asafe, reliable, and high-rate wireless connection. The Wi-Fi may be usedfor connecting the computer to the computer, the Internet, and the wirednetwork (IEEE 802.3 or Ethernet is used). The Wi-Fi network may beoperated at, for example, a data rate of 11 Mbps (802.11a) or 54 Mbps(802.11b) in an unauthorized 2.4 and 5 GHz wireless band, or may beoperated in a product including both bands (dual bands).

Those skilled in the art will appreciate that the various illustrativelogical blocks, modules, processors, means, circuits, and algorithmoperations described in relation to the exemplary embodiments disclosedherein may be implemented by electronic hardware (for convenience,called “software” herein), various forms of program or design code, or acombination thereof. In order to clearly describe compatibility of thehardware and the software, various illustrative components, blocks,modules, circuits, and operations are generally illustrated above inrelation to the functions of the hardware and the software. Whether thefunction is implemented as hardware or software depends on design limitsgiven to a specific application or an entire system. Those skilled inthe art may perform the function described by various schemes for eachspecific application, but it shall not be construed that thedeterminations of the performance depart from the scope of the presentdisclosure.

Various exemplary embodiments presented herein may be implemented by amethod, a device, or a manufactured article using a standard programmingand/or engineering technology. A term “manufactured article” includes acomputer program, a carrier, or a medium accessible from a predeterminedcomputer-readable device. For example, the computer-readable storagemedium includes a magnetic storage device (for example, a hard disk, afloppy disk, and a magnetic strip), an optical disk (for example, a CDand a DVD), a smart card, and a flash memory device (for example, anEEPROM, a card, a stick, and a key drive), but is not limited thereto.Further, various storage media presented herein include one or moredevices and/or other machine-readable media for storing information. Aterm “machine-readable medium” includes a wireless channel and variousother media, which are capable of storing, holding, and/or transportinga command(s) and/or data, but is not limited thereto.

It shall be understood that a specific order or a hierarchical structureof the operations included in the presented processes is an example ofillustrative accesses. It shall be understood that a specific order or ahierarchical structure of the operations included in the processes maybe rearranged within the scope of the present disclosure based on designpriorities. The accompanying method claims provide various operations ofelements in a sample order, but it does not mean that the claims arelimited to the presented specific order or hierarchical structure.

The description of the presented exemplary embodiments is provided so asfor those skilled in the art to use or carry out the present disclosure.Various modifications of the exemplary embodiments may be apparent tothose skilled in the art, and general principles defined herein may beapplied to other exemplary embodiments without departing from the scopeof the present disclosure. Accordingly, the present disclosure is notlimited to the exemplary embodiments suggested herein, and shall beinterpreted within the broadest meaning range consistent to theprinciples and new characteristics presented herein.

The various embodiments described above can be combined to providefurther embodiments. All of the U.S. patents, U.S. patent applicationpublications, U.S. patent applications, foreign patents, foreign patentapplications and non-patent publications referred to in thisspecification and/or listed in the Application Data Sheet areincorporated herein by reference, in their entirety. Aspects of theembodiments can be modified, if necessary to employ concepts of thevarious patents, applications and publications to provide yet furtherembodiments.

These and other changes can be made to the embodiments in light of theabove-detailed description. In general, in the following claims, theterms used should not be construed to limit the claims to the specificembodiments disclosed in the specification and the claims, but should beconstrued to include all possible embodiments along with the full scopeof equivalents to which such claims are entitled. Accordingly, theclaims are not limited by the disclosure.

The invention claimed is:
 1. A non-transitory computer readable mediumhaving contents which cause one or more processors of a computing deviceto perform a method, the method comprising: receiving a plurality ofdifferent data in a data set including data comprised of one or morefeature groups obtained by a sensor, the plurality of different data ina data set including data acquired by the sensor before a setting changeof an equipment coupled to the sensor and data acquired by the samesensor after the setting change of the same equipment coupled to thesame sensor; selecting, by a processor among the one or more processors,the plurality of different data in the data set including data comprisedof one or more feature groups; transforming, by the processor, a valuefor one or more feature groups included in each data among the pluralityof different data; assigning, by the processor, an abnormal label toeach transformed data; calculating, by the processor, the transformeddata using a model; classifying the data acquired before the settingchange in the equipment through a trained classification model into afirst data subset; and classifying the data acquired after the settingchange in the equipment through the trained classification model into asecond data subset, wherein the setting change of the equipment includeschanging of operation parameters of the equipment.
 2. The non-transitorycomputer readable medium according to claim 1, wherein the plurality ofdifferent data is comprised of data included in a same cluster ordifferent clusters.
 3. The non-transitory computer readable mediumaccording to claim 1, wherein the method further comprises generating aplurality of data subsets through clustering data of the data set. 4.The non-transitory computer readable medium according to claim 3,wherein the generating a plurality of data subsets through clusteringdata of the data set includes processing by a classification modeltrained by using a cost function based on triple loss.
 5. Thenon-transitory computer readable medium according to claim 3, whereineach data subset in the plurality of data subsets includes differentdata having a normal pattern.
 6. The non-transitory computer readablemedium according to claim 1, wherein the transforming a part of eachdata from the selected different data includes exchanging value for onedata and value for another data among the plurality of data.
 7. Thenon-transitory computer readable medium according to claim 6, whereinthe exchanging value for one data and value for another data among theplurality of data includes exchanging value for one or more featuregroups in one data and value for one or more feature groups in anotherdata among the plurality of data.
 8. The non-transitory computerreadable medium according to claim 6, wherein the exchanging value forone data and value for another data among the plurality of data includesexchanging values for data belonging to a same feature group in eachdata.
 9. The non-transitory computer readable medium according to claim1, wherein the data included in the data set is a normal data.
 10. Thenon-transitory computer readable medium according to claim 1, whereinthe calculating the transformed data using a model includes testing aperformance of the model through calculating the transformed data usingthe model.
 11. The non-transitory computer readable medium according toclaim 10, wherein the testing a performance of the model throughcalculating the transformed data using the model includes testing theperformance of the model based on whether or not the transformed data isjudged abnormally by the model.
 12. The non-transitory computer readablemedium according to claim 1, wherein each feature group is comprised ofitems associated among a plurality of items included in the data.
 13. Amethod for processing data performed in a computing device including oneor more processors, comprising: receiving a plurality of different datain a data set including data comprised of one or more feature groupsobtained by a sensor, the plurality of different data in a data setincluding data acquired before and after a setting change of anequipment coupled to the sensor, wherein the setting change of theequipment includes changing of operation parameters of the equipment;selecting, by a processor among the one or more processors, theplurality of different data in the data set including data comprised ofone or more feature groups; transforming, by the processor, a value forone or more feature groups included in each data among the plurality ofdifferent data; assigning, by the processor, an abnormal label to eachtransformed data; calculating, by the processor, the transformed datausing a model, classifying the data acquired before the setting changein the equipment through a trained classification model into a firstdata subset; and classifying the data acquired after the setting changein the equipment through the trained classification model into a seconddata subset.
 14. A computing device, including: one or more processors;and a memory storing commands executable in processor, wherein theprocessor is configured to: receive a plurality of different data in adata set including data comprised of one or more feature groups obtainedby a sensor, the plurality of different data in a data set includingdata acquired before and after a setting change of an equipment coupledto the sensor; select the plurality of different data in the data setincluding data comprised of one or more feature groups; transform avalue for one or more feature groups included in each data among theplurality of different data; assign an abnormal label to eachtransformed data; calculate the transformed data using a model, classifythe data acquired before the setting change in the equipment through atrained classification model into a first data subset; and classify thedata acquired after the setting change in the equipment through thetrained classification model into a second data subset.
 15. Thenon-transitory computer readable medium according to claim 1, whereinthe contents comprise instructions executed by the one or moreprocessors of the computing device.
 16. A non-transitory computerreadable medium having contents which cause one or more processors of acomputing device to perform a method, the method comprising: receiving aplurality of different data in a data set including data comprised ofone or more feature groups obtained by a sensor, the plurality ofdifferent data in a data set including data acquired by the sensorbefore a setting change of an equipment coupled to the sensor and dataacquired by the same sensor after the setting change of the sameequipment coupled to the same sensor; selecting, by a processor amongthe one or more processors, the plurality of different data in the dataset including data comprised of one or more feature groups;transforming, by the processor, a value for one or more feature groupsincluded in each data among the plurality of different data; assigning,by the processor, an abnormal label to each transformed data;calculating, by the processor, the transformed data using a modelselecting a first data from a first data subset, the first dataincluding one or more feature groups; selecting a second data from thesecond data subset, the second data including one or more featuregroups; and using the first data and the second data for training themodel after transforming the value for one or more feature groupsincluded in each data among the plurality of different data, including:using the first data and the second data as abnormal data for trainingthe model after transforming the value for one or more feature groupsincluded in each data among the plurality of different data.